New Zealand may be caught up in massive global hack – tech expert
Of course it is “Russia, Russia, Russia” on instructions from Beijing Joe.
The comrades in Beijing would never do such a thing, would they?
The latest global ransomware attack may have affected IT for 11 schools in New Zealand.
The attack came to light early yesterday, hitting a Miami-based IT company, Kaseya, and infiltrating companies using that firm’s software.
The Ministry of Edcuation said it is working with the schools to provide support and will continue to identify if other schools have been impacted.
The ministry’s deputy secretary business enablement and support, Zoe Griffiths, said any school that believes they may have Kaseya VSA software installed should first contact their IT provider.
They should also undertake the recommended steps in an advisory on the CERT NZ website.
Earlier today, IT security expert Daniel Ayers said New Zealand organisations may have been caught up in the ransomware attack.
Ayers said this sort of “supply chain” attack is significant and there are a number of IT service providers in New Zealand that use Kaseya.
“There’s been information released on the internet that there are people affected in New Zealand. Some of the anti-virus providers have released information that they have seen detections in New Zealand.”
Ayers said the timing of the attack means some companies may not discover they are affected until they start work tomorrow morning.
Local tech company Datacom said it has shut down its servers that use Kaseya software after the attack.
A spokesperson for the company said it had been decommissioning the software, even before yesterday’s attack.
It has been monitoring the situation for its customers and has not found any sign of incursions.
The cyber-security watchdog CertNZ is advising organisations using Kaseya to shut down those servers.
Kaseya provides IT management software for Managed Service Providers (MSPs) and small to mid-sized businesses (SMBs) – linking clients and partners in New Zealand.
Kaseya has previously publicised its links to New Zealand-based CodeBlue and other Australasian IT companies, including BigAir, Datacom, eNerds, Leap Consulting, Surety IT and Ricoh Australia.
President Joe Biden has directed US intelligence agencies to investigate who was behind the attack that also hit hundreds of American businesses.
As well, 500 Coop supermarket stores in Sweden have been forced to close.
Coop Sweden said it closed more than half of its 800 stores on Friday after point-of-sale tills and self-service checkouts stopped working.
Security firm Huntress said it believed the Russia-linked REvil ransomware gang was to blame for the latest ransomware outbreak. Last month, the FBI blamed the same group for paralysing meat packer JBS.
In a statement, the US Cybersecurity and Infrastructure Security Agency said it was “taking action to understand and address the recent supply-chain ransomware attack” against Kaseya’s VSA product.
US and British authorities said Russian spies accused of interfering in the 2016 US presidential election have spent much of the past two years abusing virtual private networks (VPNs) to target hundreds of organisations worldwide.
Russia’s embassy in Washington has denied that charge
Kaseya VSA ransomware: Extent of impact yet to be seen, experts say
US authorities suspect that Russian-based cybercriminal gang REvil may be behind the attack. Photo: 123RF
US-based Kaseya, which provides IT management software for Managed Service Providers and small to mid-sized businesses, had its VSA software infiltrated with ransomware over the weekend.
Hundreds of organisations across the world have been affected, with at least 11 schools in New Zealand implicated as well.
In a statement, a Ministry of Education spokesperson said they were working to see if any more education providers had been impacted.
“We advise any school that believes they may have Kaseya VSA software installed to contact their IT provider in the first instance and undertake the recommended mitigation as per the CERT NZ advisory.”
St Peter’s School in Cambridge yesterday said it was one of those exposed, but it had since stabilised its system and was working to recover data.
“As a result, all school systems are inactive and will be for at least the next 48 hours,” the school said in a Facebook post.
Cybersecurity watchdog CERT NZ urged all users of the software to shut it down until further notice.
Datacom, one of New Zealand’s largest IT services firm, yesterday said it had shut down its servers that use Kaseya software after the attack.
A spokesperson for the company said it had been decommissioning the software, even before yesterday’s attack.
Strategic communications manager Paul Brislen told Morning Report Kaseya helped automate patches and updates that security and IT companies send out.
“One of their servers has been compromised and spread this ransomware attack throughout the customer base and as people are waking up and switching on their computers and they get an email apparently from Kaseya, they click on the link and then there we are, they’re infected.”
He said there was a limited number of their servers using that software.
Those affected had their information encrypted and usually get a demand for money to have it back. However, CERT NZ strongly discourages people from paying because the culprits often go back for more money or blackmail people with the obtained information.
Brislen said this attack was similar to the recent one on the Waikato District Health Board.
“Your files are locked up, they may be copied, so that they can blackmail you later and say ‘well you still haven’t paid, we’ll start releasing the information out into the public space’.
“It’s a money-making trick that seems to have taken over the cybersecurity world.
“Naturally the secret here if you do want to restore servers quickly, you have got to have a robust back-up programme so you can just turn around and switch that on instead of worrying about the stuff that’s been locked up.”
US authorities suspect that Russian-based cybercriminal gang REvil may be behind the attack. Brislen said that could be the case.
“They could well be from Russia. The only evidence one way or the other as to where this gang is from is that they do use the Russian language when communicating with each other and with authorities.”
‘It’s a very difficult attack to defend against’ – IT security consultant
Brislen, CERT NZ and IT security consultant Daniel Ayers all say it’s too early to say how widespread the impact of the attack is, considering most organisations would have been away from work over the weekend and its timing with the 4 July celebrations.
Ayers told Morning Report international internet security company Eset has detected instances of the ransomware in New Zealand, and that some of those would be the affected schools but whether that was all was yet to be seen.
“The latest information I’ve seen is an estimate of 30 IT providers worldwide affected, and upwards of 1000 of their customers encrypted.”
CERT NZ incident response manager Nadia Yousef said: “It started to unfold late on Friday night and I suspect that as more organisations go to work this morning and turn their machines on, figure out whether things are, there is a chance we could see more impact.
“It’s been a big year for ransomware, and what we’ve seen is that there’s so many different ways that attackers can get into people’s systems and go after people.”
Yousef told Morning Report they encouraged organisations to get ahead by implementing prevention steps and also having a plan on what to do if they are affected at some point.
“It’s not always easy, and there’s no silver bullet, but having good long and strong unique passwords for all of your accounts and using multi-factor authentication as well as updating your application for new software.”
Datacom spokesperson Paul Brislen said ransomware attacks were becoming more common and viruses or hacking methods were “chump change” in comparison for attackers.
“Because of the pace and the sophistication of these attacks, it’s becoming increasingly more destructive as time goes on.”
IT security consultant Daniel Ayers told Morning Report a supply chain attack usually targets a person higher up the supply chain that others trusted.
“Generally when organisations are hit by ransomware, it indicates poor security in the organisation.
“This is different. Here, the affected organisations had been using IT management software which is good practice – the poor security lies not with the IT companies that were running their IT, but further up the supply chain at the end of the creator of the software.
“So it’s a very difficult attack to defend against.”
He said this would be a “very major incident for Kaseya”.
“It has the potential possibly to destroy the company in my opinion.
“This is like a thousand Waikato DHBs all over again.”
He advised organisations to have lots of layers of different protection, so that if a ransomware attack could not be stopped, it would at least be able to lessen the impact.
US companies hit by ‘colossal’ cyber-attack
About 200 US businesses have been hit by a “colossal” ransomware attack, according to a cyber-security firm.
Biden Insists “We’re Not Sure” Russians Behind Ransomware Attack On 200 US Companies
“We’re not sure if it’s the Russians,” President Biden said Friday in response to the latest allegations that a ‘Russian-linked hacker group’ targeted some 200 US companies in a massive ransomware attack. But he’s vaguely promising a “response” if Kremlin links can be found.
This latest major incident unveiled at the end of this past week is being described as akin to “SolarWinds with ransomware,” which paralyzed the networks of the US companies. Wired explains the inevitability that the “the two dominant cybersecurity threats of the day— supply chain attacks and ransomware—would combine to wreak havoc.” It’s also being called “colossal” in scope and appears to involve blackmail payment demands just as in prior major breaches.
Wired writes further of the aftermath as details continue to fall into place, “That’s precisely what happened Friday afternoon, as the notorious REvil criminal group successfully encrypted the files of hundreds of businesses in one swoop, apparently thanks to compromised IT management software. And that’s only the very beginning.”
The hack targeted the Florida-based software management firm Kaseya, which said Friday afternoon it was the “victim of a sophisticated cyberattack” which caused it to immediately alert all of its clients to shut down their impacted servers. The US Cybersecurity and Infrastructure Security Agency (CISA) quickly said it’s launching an investigation the same day, “taking action to understand and address the supply-chain ransomware attack against Kaseya,” according to its statement.
Soon after disembarking Air Force One, Biden appeared a bit confused but also bluntly insisted there’s no certainty it was the Russians: “First of all, we’re not sure who it is for certain, number one,” he said while being peppered with reporters’ questions over the then developing incident:
“I’ll be in better shape to talk to you about it—hang on a second,” the president said as he reached into his pocket to pull out a note card.
“I’ll tell you what they sent me, OK?” the president continued. “First of all, we’re not sure who it is for certain, number one.”
“And the fact is that I directed the intelligence community to give me a deep dive on what’s happened, and I’ll know better tomorrow. And if it is, either with the knowledge of and/or a consequence of Russia, then I told Putin we will respond,” Biden said.
Here’s his awkward interaction with reporters inside a store during a Michigan stop…
Based on his quickly referencing the initial intelligence he was sent, the president seemed to clearly confirm that US agencies have reached no conclusions on Russian involvement as yet, despite a slew of media reports hastily pointing in that direction, as is usual.
Biden reiterated this position when asked about phoning President Putin over the new breach:
Asked if has spoken with Russian President Vladimir Putin about the hack, Biden said he has not.
“I haven’t called because we’re not certain. And the initial thinking was it was not the Russian government, but we’re not sure yet,” Biden said.
He had said he “got a brief as I was on the plane and that’s why I was late”. The FBI is also said to be involved in probing the large-scale cyberattack which is being called by cyber security specialists a “colossal and devastating supply chain attack.”
According to multiple reports that emerged over the weekend, the hacking collective REvil is demanding that victim companies pay $45,000 in the cryptocurrency Monero to gain back access to their systems, warning that the payment will double each week they fail to pay up.
Despite Biden denying anything conclusive pointing to Russia being behind it, US mainstream media will undoubtedly hype a “Kremlin attack” through Sunday into Monday, which will in turn likely put more pressure on the administration to more aggressively put blame on Russian intelligence and in turn “take action” – evidence or not – likely in the form of more sanctions. The president has so far ordered a top level investigation into the ransomware attack.
